CVE-2026-47185: Frappe Has Broken Access Control in its Workspace Save API
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
frappeto a version that resolves this vulnerability.Fixed in 16.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47185?
CVE-2026-47185 has a moderate risk rating of 60.
How do I fix CVE-2026-47185?
To fix CVE-2026-47185, update to Frappe version 16.18.0 or later.
What kind of vulnerability is CVE-2026-47185?
CVE-2026-47185 is a broken access control vulnerability affecting the Workspace Save API.
What are the potential consequences of CVE-2026-47185?
CVE-2026-47185 allows authenticated users to modify another user's private workspace and perform persistent script injection.
Which component of Frappe is affected by CVE-2026-47185?
CVE-2026-47185 affects the Frappe Workspace Save API.